Roles and permissions
A role is a set of permissions, such as Sales or Support. People get permissions through their roles; a person with several roles gets the widest access of them together.
Roles are in Administration › Roles. Only administrators can create and change roles; user managers can see them.
Creating a role
New role starts empty, or copies the permissions of an existing role, which you then change. Copy next to a role does the same.
Administrators
A role marked Administrator can see and change everything: every entity, every record and every page of the administration. No other permissions need to be set for it. The administrator made during installation has this role.
Give it to as few people as you can.
Entity permissions
For each entity, a role sets what its users may do with the records:
| Permission | Choices | Meaning |
|---|---|---|
| See | None, own, all | Which records they see in lists and can open |
| Add | Yes or no | Whether they may add records |
| Change | None, own, all | Which records they may edit |
| Delete | None, own, all | Which records they may move to the trash and restore |
| Export | None, own, all | For exporting records, in a coming version |
Own means the records the person created. A salesperson who may see their own deals but all companies would have See: own for deals and See: all for companies.
An entity that none of a person's roles may see is missing from their menu.
Administration permissions
Administration permissions open parts of the building and administration to people who are not administrators:
| Permission | Allows |
|---|---|
| Add and change entities and fields | Building: modules, entities and fields |
| Manage choice lists | Choice lists |
| Invite, edit and deactivate users | Users, within the roles they may give |
| Design forms and share views | List design |
| Delete records in the trash for good | Deleting records permanently |
| Import records from CSV | Importing, in a coming version |
| Edit translations | Translations, in a coming version |
| Edit the theme | The theme, in a coming version |
| Read the audit log | The audit log, in a coming version |
Settings, the System page, updates and roles stay with administrators.
Roles a user manager may give
Roles its user managers may give decides which roles people with this role can give and take away, when they also have the permission to manage users. A team lead might give Sales only, never Administrator.